IR 05000440/2017010
| ML17236A187 | |
| Person / Time | |
|---|---|
| Site: | Perry  |
| Issue date: | 08/24/2017 |
| From: | Pederson C D NRC/RGN-III |
| To: | Hamilton D FirstEnergy Nuclear Operating Co |
| Lambert K J | |
| References | |
| EA-17-043, IR 2017010 | |
| Download: ML17236A187 (11) | |
Text
UNITED STATES NUCLEAR REGULATORY COMMISSION REGION III 2443 WARRENVILLE RD. SUITE 210 LISLE, IL 60532-4352 August 24, 2017
Mr. David Hamilton Site Vice President FirstEnergy Nuclear Operating Company Perry Nuclear Power Plant Mail Stop A-PY-A290 P.O. Box 97, 10 Center Road Perry, OH 44081-0097
SUBJECT: PERRY NUCLEAR POWER PLANT-FINAL SIGNIFICANCE DETERMINATION OF A WHITE FINDING AND NOTICE OF VIOLATION; NRC INSPECTION REPORT 05000440/2017010 AND ASSESSMENT FOLLOW-UP LETTER
Dear Mr. Hamilton
This letter provides you the final significance determination of the preliminary White finding discussed in U.S. Nuclear Regulatory Commission (NRC) Inspection Report 05000440/2017009, dated June 5, 2017 (ML17156A750). The finding involved the failure to evaluate the effects of voltage suppression diode failure on the Standby Diesel Generator (SDG) control circuit, which was a component subject to the requirements of Title 10 of the
Code of Federal Regulations (CFR) Part 50, Appendix B. Specifically, FirstEnergy failed to consider the effect of a shorted diode on the control circuitry of the SDG, and, as a result, failed to recognize that installation of voltage suppression diodes across control relays, with no mitigation for diode failure, was not suitable for the SDG control circuit. This introduction of new components (diodes) into the control circuitry resulted in the eventual failure of the SDG control circuit, thereby rendering the SDG inoperable and unable to start.
In letter, dated July 14, 2017, you provided a response to the NRC preliminary determination regarding the finding. Your response indicated that you believed that the description of the performance deficiency did not accurately characterize the issue. You believed the design was adequate and appropriate for use in the control circuit and without the manufacturing defect would have functioned as designed. Your requested discretion in accordance with Section 3.5 of the NRC Enforcement Policy because you believed, due to the manufacturing defect of the diode, the failure of the SDG was outside your control and was not foreseeable. You also did not agree with the apparent violation as described in our letter. Specifically, you did not agree that: (1) installation of surge suppression diodes in the SDG control circuit was not evaluated and, without mitigation for failure, was not appropriate for the SDG control power circuit; (2) installation of surge suppression diodes provided no safety benefit to the SDG control system; and (3) the diode failure rendered the SDG inoperable and unable to start for longer than its technical specification allowed outage time. The NRC's response is provided in Enclosure 1.
D. Hamilton - 2 -
After considering the information developed during the inspection and the additional information you provided in your letter, dated July 14, 2017, the NRC has concluded that the finding is appropriately characterized as White, a finding of low-to-moderate risk significance.
You have 30 calendar days from the date of this letter to appeal the staff's determination of significance for the identified White finding. Such appeals will be considered to have merit only if they meet the criteria given in Attachment 2 of Inspection Manual Chapter (IMC) 0609. An appeal must be sent in writing to the Regional Administrator, Region III, U.S. Nuclear Regulatory Commission, 2443 Warrenville Road, Suite 210, Lisle, IL 60532.
The NRC determined that the failure to consider the effect of a shorted diode on the control circuitry of the SDG, and, as a result, the failure to recognize that installation of voltage suppression diodes across control relays, with no mitigation for diode failure, was not suitable for the SDG control circuit is a violation of 10 CFR, Part 50, Appendix B, Criterion III, "Design Control," as cited in the enclosed Notice of Violation (Notice) (Enclosure 2). The circumstances surrounding the violation were described in detail in the subject inspection report and in Enclosure 1. In accordance with the NRC Enforcement Policy, the Notice is considered escalated enforcement action because it is associated with a White finding. No cross-cutting issue was assigned since the performance deficiency associated with this finding occurred more than 3 years ago; therefore, it did not reflect current licensee performance.
The NRC has concluded that information regarding the reason for the violation, the corrective actions taken and planned to correct the violation and prevent recurrence, and the date when full compliance was achieved is already adequat ely addressed on the docket in NRC Inspection Report 05000461/2015009. Therefore, you are not required to respond to this letter unless the description therein does not accurately reflect your corrective actions or your position.
As a result of our review of Perry's performance, including this White finding, we have assessed the Perry Nuclear Power Plant to be in the Regulatory Response column of the NRC's Action Matrix, effective the second quarter of 2017. Therefore, we plan to conduct a supplemental inspection using Inspection Procedure 95001, "Inspection for One or Two White Inputs in a Strategic Performance Area," when your staff has notified us of your readiness for this inspection. This inspection procedure is conducted to provide assurance that the root cause and contributing cause of risk significant performance issues are understood, the extent of condition and the extent of cause are identified, and the corrective actions are sufficient to
prevent recurrence.
In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosures, and your response, if you choose to provide one, will be made available electronically for public inspection in the NRC Public Document Room or from the NRC's Agencywide Documents Access and Management System (ADAMS) accessible from the NRC's
D. Hamilton - 3 -
Web site at http://www.nrc.gov/reading-rm/adams.html. To the extent possible, your response should not include any personal privacy, proprietary, or safeguards information so that it can be made available to the Public without redaction.
Sincerely,/RA by James M. Trapp acting for/
Cynthia D. Pederson
Regional Administrator Docket No. 50-440 License No. NPF-58
Enclosures:
1. NRC's response 2. Notice of Violation
cc: Distribution via LISTSERV
Enclosure 1 NRC RESPONSE TO INFORMATION PROVIDED BY FIRSTENERGY NUCLEAR OPERATING COMPANY IN LETTER, DATED JULY 14, 2017 On July 14, 2017, FirstEnergy Nuclear Operating Company (FirstEnergy) submitted their response to the preliminary white finding and associated violation. FirstEnergy believed the description of the performance deficiency did not accurately characterize the issue.
FirstEnergy also described three aspects of the apparent violation they did not agree with.
Finally, FirstEnergy requested that discretion be considered as described in the U.S. Nuclear Regulatory Commission's (NRC) Enforcement Policy, Section 3.5. The following details FirstEnergy's position as described in their letter as well as the NRC response.
Appropriateness of the stated Performance Deficiency: "The inspectors determined that the licensee's failure to evaluate the effects of voltage suppression diode failure on the SDG control circuit was contrary to the requirements of 10 CFR Part 50, Appendix B, Criterion III, and a performance deficiency. Specifically, the licensee failed to consider the effect of a shorted diode on the control circuitry of the SDG and, as a result, failed to recognize that installation of voltage suppression diodes across control relays, with no mitigation for diode failure, was not a suitable modification of the SDG control circuit."
o FirstEnergy Position:
The FirstEnergy Nuclear Operating Company (FENOC) does not agree with the performance deficiency as described. FENOC asserts that the design was adequate and appropriate for use in the control circuit and without the manufacturing defect would have functioned as designed.
o NRC position:
The NRC position is that the design, as implemented, failed to consider the effect of a shorted diode on the control circuitry of the diesel generator.
The staff notes that there could be multiple causal factors which contribute to the occurrence of the degraded condition. However, in accordance with the Reactor Oversight Process framework, only a single proximate cause needs to be linked to the performance deficiency. In this particular case, we concluded that the design modification was the most significant contribution to the degraded
condition.
Appendix B, Criterion III, of 10 CFR Part 50, requires, among other things:"Measures shall also be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components"; and "The design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of 2 alternate or simplified calculation methods, or by the performance of a suitable testing program."
FirstEnergy had the ability to evaluate the potential failure consequences from a failed suppressor diode and should have considered and documented such when the existing diesel generator circuitry was modified. Therefore, the failure to evaluate the effects of voltage suppression diode failure on the SDG control circuit was a performance deficiency.
Disagreement with the apparent violation: Installation of surge suppression diodes in the standby diesel generator control (SDG) circuit was not evaluated and, without mitigation for failure, was not appropriate for the SDG control power circuit.
o FirstEnergy position:
The effects of a diode failure were considered as an aggregate evaluation of parts rather than component by component individual evaluations. The Updated Safety Analysis Report (USAR) does not discuss the reliability of the standby diesel generator (SDG) components at the level that the change was being made. For the SDG engine and generator, the USAR only discusses malfunction of the SDG as a unit with the result being the loss of one divisional SDG. There are no failure modes and effects analysis in the USAR for subcomponents of the diesel generator itself, the speed control system or its controls.
No new failure modes were introduced by the addition of surge suppression diodes as addressed in NEI 96-07, "Guidelines for 10 CFR 50.59 Evaluations," Section 4.3.6. The 50.59 evaluation for ECP 04-0049 states, "Reliability of the new components has been based on industry experience and experience at other nuclear facilities. -[operating] experience was reviewed through [Institute of Nuclear Power Operations] and no adverse trends were noted for the new components."
The diodes were installed consistent with IEEE recommended practice for Powering and Grounding Electronic Equipment Section 10.4.4.1, Contact Suppression, IEEE Std. 1100-2005, which states, this is standard practice in any industrial control system. It also states that the first choice in a DC circuit is a flyback diode for voltage suppression. The IEEE standard does not provide mitigation strategies for diode failure.
o NRC position:
Prior to issuing the preliminary white finding and associated violation, the NRC understood FirstEnergy's position that the USAR failure analyses are done assuming an aggregate of parts (such as a total diesel generator) and not on an individual subcomponent basis. This 3 does not alleviate the design control requirement of ensuring measures are established for the selection and review for suitability of application of materials, parts, equipment and processes that are essential to the safety-related functions of the structures systems and components, and that do or may impact the overall functioning of the aggregated parts. In this case, the diesel generator and the introduction of a new component that could fail.
We also understand the recommendations in the IEEE standard; however, the configuration, sizing and the failure impacts would still need to be assessed in accordance with 10 CFR Part 50 Appendix B.
We disagree no new failure modes were introduced by the addition of the surge suppression diodes. Specifically, the addition of the surge suppression diodes without mitigation for diode failure caused an undetectable failure of the SDG and impacted the overall reliability of the diesel generator. Appropriate design considerations include effects from a shorted diode and means to mitigate such failures, such as isolation devices or current limiting components.
Installation of surge suppression diodes provided no safety benefit to the SDG control system.
o FirstEnergy Position:
The use of the suppression diodes does provide a safety benefit in that the voltage suppression helps to minimize arcing and degradation of contacts that interrupt current to the relays (reference the Root Cause Report for CR 2016-14456). It was later determined that the diodes could be removed without significantly impacting components in the Division 1 and 2 125 VDC control circuitry and the increased risk could be managed through preventative maintenance (PM) frequency controls.
o NRC Position:
We agree with your position that the diodes could provide a safety benefit. Appropriate design and installation of such devices could provide a preventative maintenance and reliability benefit in that the relays would not have to be tested or replaced on an increased frequency due to minimized operational wear.
Nonetheless, we note that FirstEnergy agreed in both their root cause evaluations, as well as their response letter, that the diodes were not required to protect components in the control power circuits and could be removed.
A 10 CFR Part 21 notification issued for the diodes on March 27, 2017, stated that it was acceptable to remove the diodes from their 4 relays and that no changes or impacts would be expected for the associated equipment.
The diode failure rendered the standby diesel generator inoperable and unable to start for longer that its technical specification allowed outage time.
o FirstEnergy Position:
Continuity testing in May 2016 demonstrated that the diode was not shorted, therefore, had not failed upon de-energization in April 2015.
The apparent violation stated that the test conducted in May 2016 was not a valid test. Although continuity testing would not have detected an internal manufacturing defect, it was an adequate test to determine if the diode was shorted, which would have precluded the SDG from performing its intended function.
The root cause concluded the cause to be a defective diode (cracked die). It is not clear at what point in time the degradation of the diode would have progressed to the point of failing upon re-energization.
With a cracked die in the diode, there are multiple stressors that could have affected it, including temperature changes. Therefore, there is no firm evidence demonstrating that the diode was failed in May 2016. As such, with the absence of firm evidence otherwise, it should be assumed that the diode failed at the time of discovery.
o NRC position:
The continuity test does not prove that the diode was capable of performing its safety function (i.e., not shorting when energized).
Specifically, the continuity test does not pass design voltage and current through the diode to ensure functionality.
The NRC noted that the Root Cause Analysis Report, CR-2014-14456 (Page 15-16), stated "Additionally, testing of that diode would have been similar to the Div 1 R11A diode which consisted of a go/no go test for an actual short and not bench testing for reverse bias voltage/current leakage required to identify degradation."
Therefore, the NRC concluded that a continuity testing alone is not a reliable means to detect diode failure.
The diode in the diesel generator emergency start circuit failed the next time the emergency start circuit was energized after the April 2015 test. The NRC determined there was no credible degradation mechanism that would degrade the diodes while they were not energized. Therefore, we concluded the diode would have failed the next time the circuit was energized, independent of the time that had elapsed.
FirstEnergy also requested enforcement discretion be granted in accordance with NRC's Enforcement Policy, Section 3.5, which states, the NRC may refrain from issuing enforcement action for violations resulting from matters not within the 5 FirstEnergy's control, such as equipment failures that were not avoidable by reasonable QA measures of management controls.
o FirstEnergy Position:
FirstEnergy believes this to be the case in that this manufacturing defect was not detected through the supplier's commercial grade dedication process.
o NRC position:
The NRC concluded enforcement discretion is not applicable in this case because a performance deficiency was identified, it is not an old design issue and it was not identified as part of an initiative. As discussed above, FirstEnergy should have considered the potential additional failure mechanisms from the addition of new components to the existing diesel generator control circuitry.
Enclosure 2 NOTICE OF VIOLATION
FirstEnergy Nuclear Operating Company Docket No. 50-440 Perry Nuclear Power Plant License No. NPF-58 EA-17-043
During a U.S. Nuclear Regulatory Commission (NRC) inspection conducted between December 12, 2016, and April 27, 2017, a violation of NRC requirements was identified. In accordance with the NRC Enforcement Policy, the violation is listed below:
Title 10 of the Code of Federal Regulations (CFR), Part 50, Appendix B, Criterion III, "Design Control," requires, in part, that measures be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components.
Technical Specification (TS) 3.8.1 "AC Sources-Operating," requires, in part, that three diesel generators be operable in Modes 1, 2, and 3. Condition B.4 states, in part, that the required inoperable diesel generator be restored to operable status within 14 days. Required Action F.1 states the reactor be in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, and Required Action F.2 states the reactor be in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> if the completion time specified in
B.4 is not met.
From April 24, 2007, until November 8, 2016, the licensee failed to review for suitability of application of parts essential to the safety-related functions of the Division 2 Standby Diesel Generator, a safety-related system. Specifically, Engineering Change Package 04-00049 failed to consider the effects of shorted voltage suppression diodes installed on the control circuitry for the Division 2 Standby Diesel Generator, and instead, introduced new components (diodes) into the control circuitry that resulted in the eventual failure of this
safety-related equipment. Consequently, on November 6, 2016, the Division 2 Standby Diesel Generator emergency start circuit diode associated with relay RR10BB was found failed after an unsuccessful attempt to test the emergency start function. The Division 2 Standby Diesel Generator was inoperable and unable to perform its emergency start function from April 2, 2015, until the emergency start diode was replaced and the Division 2 Standby Diesel Generator was returned to se rvice on November 8, 2016, a period longer than the Technical Specification allowed outage time of 14 days. Additionally, because the licensee was not aware of the diesel generator's inoperability during the unit's operation cycle, the required actions of TS 3.8.1.F.1 and 3.8.1.F.2 were not followed.
This violation is associated with a White SDP finding.
The NRC has concluded that information regarding the reason for the violation, the corrective actions taken and planned to correct the violation and prevent recurrence, and the date when full compliance was achieved is already adequately addressed on the docket in Inspection Report 05000440/2017009. However, you are required to submit a written statement or explanation pursuant to 10 CFR 2.201 if the description therein does not accurately reflect your corrective actions or your position. In that case, or if you choose to respond, clearly mark your response as a "Reply to a Notice of Violation, EA-17-043," and send it to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001 with a
copy to the Regional Administrator, Region III, and a copy to the NRC Resident Inspector at the facility that is the subject of this Notice, within 30 days of the date of the letter transmitting this
Notice of Violation (Notice).
2 If you contest this enforcement action, you should also provide a copy of your response, with the basis for your denial, to the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001. If you choose to respond, your
response will be made available electronically for public inspection in the NRC Public Document Room or from the NRC's Agencywide Documents Access and Management System (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html. Therefore, to the extent possible, the response should not include any personal privacy, proprietary, or safeguards information so that it can be made available to the Public without redaction.
In accordance with 10 CFR 19.11, you may be required to post this Notice within two working days of receipt.
Dated this 24 th day of August 2017